Cyber Security Course - Understanding Cyber Security PDF

Cyber Security Course Understanding Cyber UNIT-1 Security Learning Outcomes By the end of this unit the learner will be able to:  Define cyber security and its primary...

Cyber Security Course Understanding Cyber UNIT-1 Security Learning Outcomes By the end of this unit the learner will be able to:  Define cyber security and its primary objectives  Understand the various causes of cybercrime and those responsible for threats to cyber security  Discuss the classifications of cyber crime and Microsoft’s 10 laws of computer security Page | 1 Cyber Security Course Unit 1 Understanding Cyber Security What is Cyber Security? The term ‘cyber security’ refers to all safeguards and measures implemented to reduce the likelihood of a digital security breach. Cyber security affects all computers and mobile devices across the board – all of which may be targeted by cyber criminals. Cyber security focuses heavily on privacy and confidentiality, along with data integrity and identity protection. Security breaches in general are nothing new, but have become more commonplace and problematic in today’s digital era. The greater the extent to which the world becomes reliant on connected technology, the greater the threat posed by cybercriminals worldwide. From reputation damage to system downtime to financial loss, cyber security issues can be incredibly costly. According to a recent study, almost half of all businesses operating in 2017 experienced at least one cyber attack or attempted security breach. Precisely the reason why businesses worldwide have begun prioritizing cyber security, implementing robust protective measures and hiring cyber security experts to oversee their operations. The Importance of Security The Internet has transformed the face of everyday life for billions of people worldwide. Already enormous, daily web traffic volumes are growing at an exponential rate. To such an extent that the vast majority of communications and business activities worldwide are fundamentally reliant on the Internet. From simple retail purchases to the most sensitive and high-profile business activities, everything takes place online. All of which adds up to a near-irresistible opportunity for the 21st century cyber criminal. Turning a blind eye to cyber security is no longer an option. Businesses that fail to adequately protect themselves face the prospect of catastrophic consequences. Irrespective of the size, nature or purpose of the business, the effects of a cyber attack can be devastating. What’s more, some of the highest- profile attacks over recent years have demonstrated how even the biggest companies in the world aren’t always as well protected as they think they are. Even when their systems are brought back online and business continues as normal, the reputational damage incurred can be much more difficult to overcome. Of course, it’s not simply a case of proactively protecting your business and its general interests from cyber attacks. You also need to think carefully about the extent to which your customers are protected. Oftentimes, a security breach that has negative consequences for one or more customers can be far more detrimental than an attack on the company itself. Businesses aren’t simply expected to protect Page | 2 Cyber Security Course their customers online – they have a legal obligation to do so. All of which amounts to yet another responsibility, which calls for the input and expertise of talented of cyber security specialists. Insiders and Outsiders As far as general data security is concerned, there are two classifications of people – insiders and outsiders (aka employees and non-employees). Figure Intro.1 shows the three classes of computer security and crime caused by each of the two types, plus a special class of threats that are not directly caused by humans, namely accidents. The seven individual classes are as follows: 1. Insiders overt. Overt actions on the part of insiders are usually the work of dissatisfied employees, often resulting in data being compromised and equipment being destroyed. 2. Insiders covert. Employees within a company can inflict more serious damage than outsiders, due to their access privileges and extensive knowledge of the organization in general. 3. Insiders unintended. Many security issues or threats that occur internally are the result of nothing more than genuine human error. This being one of the most common threat classes. 4. Outsiders overt. Direct attacks on network systems and computer facilities by outsiders, which also incorporates DoS attacks. 5. Outsiders covert. This refers to the type of attack that involves transmitting rogue software to one or more computers or systems from outside the business. 6. Outsiders unintended. It is fairly rare that an outsider will harm a computer or access sensitive data unintentionally. 7. Accidents. Issues regarding data integrity or security can arise due to unpredictable accidents that cannot be prevented, such as natural disasters, workplace fires and so on. Page | 3 Cyber Security Course There are various different classifications of computer security issues and threats, though the vast majority can be grouped under three headers as follows:  Physical Security. Examples of physical security issues include computer equipment being stolen, computer systems being accessed physically without authorization and general physical damage being caused to hardware.  Rogue Software. This is the bracket that includes all examples of computer viruses and malware. More broadly, any software introduced to a system (accidentally or otherwise) that poses or creates a security threat.  Network Security. The vast majority of computers these days are connected to one or more networks, which may be breached by insiders or outsiders. When a network is accessed or in any way compromised without authorisation, this is considered a network security issue. It’s hard to believe that such a complex and important field as computer security was largely non- existent three decades ago. The evolution of the field of cyber security in general over recent years has been no less than phenomenal. While it’s true to say that almost any security vulnerability or threat can be managed and brought under control, there is no such thing as 100% flawless protection from attacks. This is because cybercriminals are constantly refining and adapting their techniques, creating something of a continuous cat-and- mouse ‘game’ with cyber security experts. Both parties doing everything they can to stay one step ahead of the other. Microsoft’s 10 Laws of Cyber Security Leading software companies like Microsoft employ enormous teams of cyber security experts to safeguard their systems and software. Over the years, Microsoft has published an extensive archive of invaluable cyber security guidelines for businesses of all shapes and sizes. They’ve also produced and published their own “10 laws of cyber security”, which can and should be implemented at all levels throughout the business. The 10 rules outlined by Microsoft are as follows: 1. If someone can persuade you to run their program on your computer, it’s not your computer anymore. 2. If someone can alter the operating system on your computer, it’s not your computer anymore. 3. If someone has unrestricted physical access to your computer, it’s not your computer anymore. 4. If you allow someone to upload anything it’s a to your website, it’s not your website anymore. 5. Weak passwords defeat strong security. Page | 4 Cyber Security Course 6. A computer is only as secure as its owner/user is trustworthy. 7. Encrypted data is only as secure as the decryption key. 8. An out-of-date virus scanner is only marginally better than none at all. 9. Absolute anonymity isn’t practical, in real life or on the Web. 10. Technology is not a panacea. Physical Security The vast majority of cyber security threat and attacks are ‘virtual’ in nature. Or in other words, those responsible don’t gain physical access to the networks and computer systems they target. But alongside viruses, identity theft, general data security breaches and so on, there lies another aspect cyber security that’s just important as virtual security. That being, the physical protection of computer equipment again every possible eventuality. Examples of which include fires, floods, theft and accidental damage. Physical Threats One of the most common physical threats to cyber security is also one of the most overlooked and underestimated. Electrical power surges – which can occur at any time without warning – can effectively destroy electronic devices like computers in a split second. This is why the use of power surge protectors and uninterruptible power supplies is considered mandatory by cyber security experts. The more important the computer or IT system, the greater the measures that should be taken to protect them. The physical security of computers and network systems often begins and ends with the security of the facility itself. If the office or business location is not sufficiently protected from unauthorized entry, the risk of theft or damage to its property is elevated. The more difficult you make it for would-be criminals to gain access to your computers and related technology, the lower the likelihood of falling victim to attack. The physical security of the facility itself can also play a role in minimizing the threat posed by fire, flood and similar unpredictable eventualities. It’s therefore worth taking a step back from time to time to consider the extent to which your computer systems and related technology are protected. Is your building secured with impenetrable locks? Do you have a high-quality alarm and/or surveillance system in place? Have you set up a system to receive automatic alerts in the case of unauthorized entry? Exactly how much damage could a disgruntled employee cause, if they successfully gained unauthorized entry to your building? All such questions form part of the essential cyber security risk assessment, which should be performed on a regular basis. Page | 5 Cyber Security Course User tracking Accountability lies at the heart of every successful cyber security framework. Or to put it another way, you need to maintain an accurate record of who is accessing your systems, when they are accessing them, where from and what kinds of activities they are performing. The greater the extent to which you track the activities of every user, the easier it becomes to pinpoint the responsible parties in the event of a cyber security issue. A good working example is that of a team of administrators working in a doctor’s surgery. Each of these workers will have their own unique login credentials, along with a card that must be used to activate the computer system. After which, a detailed log of their activities is kept until the moment they log off. Every page they visit within the intranet, every appointment they book, every note they take and every record they access. All such information is stored securely for future access and cannot be edited or deleted by anyone in the facility. This way, any errors or oversights identified at a later date can be traced back to their origins. Most of which will, of course, turn out to be human error, but the importance of accountability cannot be overstated. These kinds of user tracking systems also serve as helpful deterrents, dissuading would-be attackers from engaging in malicious activities while logged-on. That is, unless they are able to log on using someone else’s credentials – hence, the importance of strong and regularly updated passwords. Physical Protection of Data One of the biggest problems with physical data storage devices is the fact that most of them can be easily damaged or destroyed. Hard drives, DVDs, USB sticks and so on – all relatively simple to compromise. Both accidentally and maliciously, these and other physical storage devices/mediums come to harm on a daily basis. This is why it is of the utmost importance to ensure all important data is backed up on a regular basis. Data storage devices in general should be viewed as fragile and imperfect. It should be assumed that at any time and without warning, any given device could be laid to waste. In which case, you’ll be glad you made a backup you can now use in its place. Ideally, the data you back up should be kept in a separate location, away from the original storage device. The reason being that in the case of fire, flood, theft or accidental damage, you won’t run the risk of both copies being damaged or destroyed at the same time. Backing up data using online storage facilities is an option, but again cannot be counted on as flawless. It’s important to remember that anything that exists in the virtual space of the web has the potential to be compromised at any time. Even if the likelihood is minimal, it still exists. Where data is important and you simply cannot risk losing it entirely, physical backups should be made on a regular basis and stored in a safe location. Page | 6 Cyber Security Course Recovery Planning Armed with these regularly updated backups, the proactive business is able to formulate an effective disaster-recovery plan. Your recovery plan should include a complete and detailed summary of what to do, in the event that your facility (as a whole or in part) is destroyed, or rendered inoperable. Typical information contained within a recovery plan may include the location of the data backups, instructions for the the procurement of new computer systems, the individual responsibilities of each member of the workforce, where new physical premises should be set up and so on. Along with regularly updated backups, it can also be useful to keep hard copies of important documents. This is precisely why some of the most important documents in business and in everyday life have not yet been digitized. Contracts, invoices, purchase receipts and so on – all considered too important not to keep a hard copy of. This way, even if your primary systems and backups are destroyed, you’ll still have a hard copy to work with. If you do keep hard copies, however, you’ll need to ensure they are adequately protected and destroyed when no longer needed. What is Cyber Crime? The term ‘cyber crime’ refers to any unlawful activity involving a computer or a connected device of any kind. Incidents resulting from human error or accidents are not considered cyber crimes, but may nonetheless constitute a severe cyber security risk. For a cyber crime to be committed, the individual needs to have the express desire to carry out one or more unauthorized actions, which may have catastrophic consequences for the victim. Cyber criminals typically carry out their attacks for purposes of greed, revenge or simple enjoyment. Cyber Crimes by Insiders and Outsiders Cyber criminals may be known to the organization or entity they attack, or may be a stranger they’ve never had any contact with. As a result, there are two distinct categories of cyber attacks carried out by criminal entities worldwide:  Insider Attack: An internal attack occurs when an individual engages in some kind of malicious activity, by way of their authorized access to the system. In the vast majority of instances, internal attacks are carried out by disgruntled employees, dissatisfied contractors, former employees who still have access to the organization’s systems and so on. Insider attacks can be particularly devastating, as the user may have high-level access privileges. However, insider attacks are also comparatively easy to trace back to their origins, ensuring the responsible parties are identified and held accountable.  External Attack: By contrast, external attacks occur when anyone who does not have authorized access to the company’s systems launches an attack. Any business that operates computers and Page | 7 Cyber Security Course IT systems that are connected to the Internet is technically a viable target for external attackers worldwide. Most external attacks are thwarted by firewalls and similar safeguards, though cannot be ruled out of the equation entirely. External attacks are motivated predominantly by greed, or on the basis of a dispute/disagreement with the organization in question. Structured and Unstructured Attacks Cyber attacks can also be divided into a further two categories – structured attacks and unstructured attacks. This is essentially a reference to the maturity and sophistication of the attacker at the time of the incident.  Unstructured Attack: An unstructured attack will typically be carried out by an individual with little knowledge and experience. They may also have no specific motive for the attack, or a sense of the severity of the crime they are committing. Unstructured attacks are often performed on a random basis and can therefore be highly unpredictable.  Structured Attack: The difference being that with a structured attack, the perpetrator knows exactly what they are doing and has a full understanding of the consequences of their actions. They are familiar with sophisticated hacking tools and technologies, they have a specific target in mind and most likely an objective. Essentially, structured attacks are performed by professional criminals, who know exactly what they want and have no interest in the potential consequences. The appeal of cyber crime among criminal entities worldwide is growing. This is because cyber crime has the potential to generate enormous returns, by way of a low-risk, low-investment ‘business’ venture. Not just this, but when cyber crimes are carried out by perpetrators from a far-off nation, it is almost impossible to bring them to justice. Even if they are identified, the likelihood of them being held accountable for their actions is low. The growing appeal of cyber crime representing one of many challenges facing cyber security experts and the businesses they work for worldwide. Page | 8 Cyber Security Course Figure 1.1 : Hierarchical Organisational Structure The above represents the typical hierarchical organizational structure of a cyber crime enterprise. However, the hierarchy remains in a constant state of change and is based purely on opportunity. For example, if a hacker has the knowledge and expertise to sell sensitive data directly to a buyer at a lucrative price, he or she is unlikely to involve middlemen. By contrast, if the hacker doesn’t have the contacts he or she needs to make a sale, they may only be able to operate as part of a criminal gang. Motivations for Cyber Crime Both the prevalence and the extent of the threat posed by cyber crime has grown exponentially over recent years. In terms of motivations, some of the most common reasons for engaging in these kinds of criminal activities include the following: a. Money: The vast majority of people who commit cyber crimes are motivated by the prospect of making a lot of money in a short space of time. b. Revenge: It’s also common for people to commit cyber crimes as a form of revenge. One example of which being a disgruntled former employee launching an attack on their former employer. c. Terrorism: Attacks motivated by religion or personal beliefs are becoming increasingly common, which can lead to enormous physical or economic loss for the victims. d. Fun: There’s often no specific motivation for a cyber attack, other than the entertainment of those responsible. They simply want to see what they’re capable of. Page | 9 Cyber Security Course e. Recognition: Hacking a supposedly impenetrable network can be an enormous source of pride and kudos for those operating in known cyber crime networks worldwide. f. Anonymity: Individuals who would normally shy away from crime may take part in cyber crime activities, having been won over by the prospect of near-total anonymity. g. Espionage: Computer systems worldwide are regularly hacked and/or monitored by international agencies and governments – a form of cyber espionage. As it is often difficult to identify the parties responsible for a cyber crime, it is not always possible to pinpoint any specific motivation for the act. The Different Kinds of Cyber Crime As cyber criminals continue to evolve and enhance the sophistication of their attacks, new types of cyber crime are being identified all the time. As it stands, some of the most common types of cyber crime committed on a global basis are as follows: Cyber Stalking The term ‘cyber stalking’ refers to any kind of harassment or threatening behaviour perpetrated online. Social media in particular has provided an open platform for cyber criminals to stalk victims online, with little risk of being identified or held accountable. The effects of cyber stalking on those targeted can be devastating. Child Pornography Any kind of possession, distribution or accessing of sexual images or videos of minors (under the age of 18) is a serious criminal offense. Forgery and Counterfeiting The growing sophistication of computer technology is making it easier than ever before to counterfeit documents and create forgeries. To such an extent that it can be almost impossible to differentiate a counterfeit document from an original, without the use of extensive forensics. Software Piracy and Crime related to IPRs The unauthorized reproduction and/or distribution of software is referred to as software piracy. The world’s biggest software companies invest heavily in the development of robust piracy prevention measures, but sophisticated cyber criminals are only ever a couple of steps behind. Cyber Terrorism Page | 10 Cyber Security Course Defined as the use of computer resources to intimidate or coerce government, the civilian population or any segment thereof in furtherance of political or social objectives. Phishing The term ‘phishing’ is used in reference to any attempt to acquire the personal information of one or more parties, by sending emails that look to have been sent from a trustworthy source. Common examples of which including emails that look almost identical to those sent by eBay, Amazon and Netflix, though are actually sent from rogue entities for the purpose of stealing the recipient’s private information. Another form of phishing is Smishing, in which SMS text messages are used to lure customers. Computer Vandalism Any attempt to damage or destroy a computer or IT system using either malicious software or physical force is considered computer vandalism. Computer Hacking Computer hacking occurs when an individual or group thereof gains unauthorized access to any computer, device or IT system of any kind. Computer hacking can occur locally or remotely, motivated by the desire to steal sensitive data, destroy the information stored on the system or simply make a political point. Hackers also routinely lock individuals and businesses out of their systems entirely, demanding ransom payments to ‘unlock’ their computers. There are four primary classifications of hackers, as outlined below:  White Hat: These are the professional ‘ethical’ hackers, who are hired by businesses to find issues are vulnerabilities in their defences. Rather than actually engaging in malicious activities of any kind, they simply pinpoint the kinds of problems that could open the door to cyber criminals. Some are employed by businesses on a fulltime basis, others offer their services as self-employed freelancers.  Black Hat: By contrast, the black hat hacker only has criminal intentions in mind. They may be motivated by any of the factors listed above and have no regard for the consequences of those they target. Most established black hat hackers have access to sophisticated hardware and software, along with the physical and virtual resources needed to orchestrate ambitious attacks.  Grey Hat: The grey hat hacker identifies security vulnerabilities and provides the services required to address them, usually for a predetermined fee. Page | 11 Cyber Security Course  Blue Hat: Prior to the launch of a new system or a system upgrade, an organization may hire a blue hat hacker to identify any potential issues ahead of time. Prevention at the earliest possible stage being preferable to addressing issues only when identified at a later date. Creating and distributing viruses over internet The vast majority of computer viruses serve no purpose other than to cause problems for those affected. Some hackers invest relentlessly in the development of cutting-edge viruses, with the potential to take down (or cause damage to) millions of computer systems worldwide. As a result, viruses are rarely created or distributed for the purpose of making money. Spamming Slowly but surely, spamming is being acknowledged as a form of cyber crime in its own right. In order for a message to be considered spam, it typically needs to form part of a mass mailing exercise, be sent from an entity with an unknown identity and have been sent without the express permission of the recipient. Spam emails aren’t usually ‘dangerous’ as such, but can be inconvenient and irritating at the best of times. Online Auction Fraud The popularity of online auction sites like eBay has triggered a new wave of fraudulent activities by cybercriminals. Quite simply, items are listed for sale that either don’t exist or will never reach the winning bidder. Instead, the ‘seller’ simply makes off with the money and disappears entirely. Cyber Squatting Defined as an act of reserving the domain names of someone else’s trademark, with the intent to sell it afterwards to the organization who is the owner of the trademark at an elevated price. Logic Bombs A logic bomb is formally defined as a piece of code that is intentionally inserted into a software system, which will be automatically activated when certain conditions are met. In a working example, an employer may insert a piece of code into a system that will begin wiping information and generally causing havoc, should their contract be terminated. Web Jacking Page | 12 Cyber Security Course This is a form of digital hijacking, wherein the hacker gains access to a website without authorization and summarily prevents its rightful owner from accessing it. They may do so to demand a ransom payment to unlock the site, or for political or social purposes. Internet Time Thefts Hacking the username and password of ISP of an individual and conducting online activities at their expense is referred to as Internet Time Theft. Denial of Service Attack A DoS attack occurs when a cybercriminal (or group thereof) attempts to flood a website with an influx of spam traffic, creating the kind of congestion that prevents it from operating properly. This is why it’s often necessary to tick an ‘I Am Not a Robot’ box, before being granted access to a website. Email Spoofing This is where the header information of an email is changed to hide the identity of the actual source, making it look as if the email was sent from a source that was not in fact the actual sender. Further Reading: Page | 13